Server Fault is a question and answer site for system and network administrators. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I'm using this to rate limit and it works fine:

/usr/sbin/iptables -A INPUT -p tcp --dport 80 -m recent --rcheck --seconds 60 --hitcount 2 --name WWW -j LOG --log-prefix "WWW "

/usr/sbin/iptables -A INPUT -p tcp --dport 80 -m recent --update --seconds 60 --hitcount 2 --name WWW -j DROP

/usr/sbin/iptables -A INPUT -p tcp --dport 80 -m state --state NEW -m recent --set --name WWW -j ACCEPT

The question is, I want to do the same, but the webserver is in another host. I'm natting all the traffic on port 80 to another server, lets say How do I set the limit in the forward/nat/masquerade/whatever it's called?

share|improve this question

In your iptables rules, to redirect / masquerade to another IP address, you will use the NAT table, the PREROUTING chain and then the REDIRECT action. For example:

iptables -t nat -A PREROUTING -i eth0 [or whatever you're using as an interface] -p tcp --dport 80 -j REDIRECT --to-destination [ip-address]

Add the timing and hitcount rules that you desire.

share|improve this answer
im not asking how to redirect traffic, i already do that, im asking how to rate limit the redirections to 2 per minute or something... – kcinick Apr 21 '12 at 20:37
@kcinick Put the check in your FORWARD chain (including the new destination address on the rules), instead. – Shane Madden Apr 21 '12 at 21:15
@ShaneMadden thanks, that work but there is a problem, it limit all the connections as if they come from the same ip, so if i connect 2 time the port is droped for everyone else, is there a workaround for this? – kcinick Apr 21 '12 at 21:42
I figured it out, i have to use the mangle table. – kcinick Apr 21 '12 at 22:31

Your Answer


By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.